feat: bridge Codex v0.5–v0.6 (.env hardening, trust/activation messaging)

Adopt the portable behavioral improvements from Codex-Game-Studios v0.5–v0.6 (upstream commit 259cff8) into the OpenCode-native port.

- opencode.json: add edit and glob *.env* denies (edit covers write/patch, closing a gap where agents could create/overwrite secrets via the write tool); consolidate read to a single *.env* catch-all so nested files and .envrc are covered. *.env.example stays allowed for non-secret templates.
- install.sh: banner now states installer success is static-only and a new opencode session is required before hooks/permissions/agents are active.
- audit.sh run_config: assert an edit *.env* deny exists (regression guard).
- README.md / UPGRADING.md: document the static-install-only caveat.

Verified: json.tool valid; audit.sh all 0 errors; runtime probes post-restart deny read/write on .env, sub/.env, .envrc and allow .env.example. Codex-only changes (MultiAgent-V2 role-activation proof, .codex installer internals, CCGS framework frontmatter, skill delegation dialect) intentionally not adopted — OpenCode Task/subagent model and .opencode structure make them inapplicable or already-equivalent.

Author: Cipher-85

.opencode/audit.sh

@@ -500,6 +500,10 @@ if 'instructions' not in cfg:
     print('missing instructions'); sys.exit(1)
 if 'plugin' not in cfg:
     print('missing plugin'); sys.exit(1)
+perm = cfg.get('permission', {})
+edit_rules = perm.get('edit', {})
+if not isinstance(edit_rules, dict) or not any(v == 'deny' and '.env' in str(k) for k, v in edit_rules.items()):
+    print('missing edit .env* deny'); sys.exit(1)
 sys.exit(0)
 " 2>/dev/null && pass "opencode.json valid" || fail "opencode.json invalid"
 

.opencode/install.sh

@@ -369,8 +369,11 @@ printf '  install-state.json written (schema v2).\n'
 
 # ── Done ─────────────────────────────────────────────────────────
 printf '\n╔══════════════════════════════════════════════════════════════╗\n'
-printf '║  Setup complete!                                            ║\n'
-printf '║                                                              ║\n'
-printf '║  Run: opencode                                               ║\n'
-printf '║  Then: /start                                                ║\n'
+printf '║  %-60s║\n' "Setup complete! (static install only)"
+printf '║  %-60s║\n' ""
+printf '║  %-60s║\n' "Trust this project + start a NEW opencode session before"
+printf '║  %-60s║\n' "hooks, permissions, and agents are active."
+printf '║  %-60s║\n' ""
+printf '║  %-60s║\n' "Run: opencode"
+printf '║  %-60s║\n' "Then: /start"
 printf '╚══════════════════════════════════════════════════════════════╝\n'

README.md

@@ -276,6 +276,11 @@ project files. See [Coexistence](#coexistence) below.
 4. **`.opencode/install-state.json`** — schema-v2 with SHA256 hashes, detected
    mode, preserved/created paths, and model configuration
 
+> **Static install only.** Installer success proves package deployment and
+> static verification only. Trust the target project and start a **new
+> `opencode` session** before treating its hooks, rules, permission profile,
+> or agents as active.
+
 ## Uninstall
 
 Restore the model-agnostic state (strips injected `model:` and `variant:` from

UPGRADING.md

@@ -125,6 +125,16 @@ Best when: you didn't use git to set up the template (just downloaded a zip).
 
 ---
 
+## Verify After Upgrade
+
+Installer success is static evidence only — it proves package deployment and
+the static audit, not that project hooks, rules, permissions, or agents are
+live. After any upgrade, trust the target project and start a **new
+`opencode` session** before verifying hooks, rules, permission profile, and
+agents. Keep the exact failing command and output if verification is blocked.
+
+---
+
 ## v0.4.1
 
 **Released:** 2026-04-02

opencode.json

@@ -37,8 +37,17 @@
     },
     "read": {
       "*": "allow",
-      "*.env": "deny",
-      "*.env.*": "deny",
+      "*.env*": "deny",
+      "*.env.example": "allow"
+    },
+    "edit": {
+      "*": "allow",
+      "*.env*": "deny",
+      "*.env.example": "allow"
+    },
+    "glob": {
+      "*": "allow",
+      "*.env*": "deny",
       "*.env.example": "allow"
     }
   },